Critical Flaw CVE-2025-59159 (CVSS 9.7) in SillyTavern Allows Full Remote Control of Local AI Instances

A critical flaw, CVE-2025-59159, with a CVSS of 9.7, has been disclosed in SillyTavern, a locally hosted interface for large language models and AI tools, potentially allowing remote attackers full control of SillyTavern instances. The vulnerability arises from DNS rebinding due to insufficient host validation in the web interface, enabling a malicious site to trick a victim’s browser into treating the local SillyTavern instance as trusted and granting access to its backend API.

According to CVE-WATCHTOWER, attackers could read chats, install malicious extensions, or inject HTML for phishing, effectively giving remote access without exposing the service on the network. A proof-of-concept demonstrates that a remote, unauthenticated page can rebinding to 127.0.0[.]1 and trigger authenticated requests to the victim’s local instance, with the attack requiring no prior authentication.

SillyTavern is used as a front-end for various AI model APIs and image systems, and the project patched the vulnerability in version 1.13.4, introducing a host whitelist configuration to restrict inbound requests. Users are urged to review server configurations, especially when hosting over a local network without SSL.